<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<div>Hi,<br>
<br>
testet the latest Snapshot and the 4.0.4<br>
<br>
Still the same.<br>
<br>
Regards,<br>
<br>
Florian<br>
<br>
-----Ursprüngliche Nachricht-----<br>
Von: squid-users [mailto:squid-users-bounces@lists.squid-cache.org] Im Auftrag von Amos Jeffries<br>
Gesendet: Montag, 4. Januar 2016 12:07<br>
An: squid-users@lists.squid-cache.org<br>
Betreff: Re: [squid-users] squid 4.0.3 - sslflags not working?<br>
<br>
On 4/01/2016 8:58 a.m., Florian Stamer wrote:<br>
> Hi I,m currently testing Squid 4.0.3 in Reverse Proxy Mode.<br>
><br>
> It seems that the sslflags directives "DONT_VERIFY_PEER" and "DONT_VERIFY_DOMAIN" do not work.<br>
><br>
<br>
Should be. They are planned for removal, but nothing towards that has ot happened yet.<br>
<br>
> Here is the relevant config:<br>
><br>
> https_port 443 accel cert=/etc/squid/ssl/wildcard.cer<br>
> key=/etc/squid/ssl/wildcard.key defaultsite=externeURL<br>
> cipher=HIGH:!aNULL options=SINGLE_DH_USE,NO_SSLv3<br>
> dhparams=/etc/squid/ssl/dhparams.pem<br>
> cache_peer localserver parent 443 0 proxy-only no-query no-digest<br>
> front-end-https=on originserver login=PASS ssl ssloptions=NO_SSLv3<br>
> sslflags=DONT_VERIFY_PEER,DONT_VERIFY_DOMAIN name=ExchangeCAS<br>
><br>
> It perfectly workes in my production System based on Ubuntu LTS 14.04.3, Squid 3.3.8.<br>
><br>
> Everytime i try to access the site i get an error:<br>
><br>
> The system returned:<br>
> (71) Protocol error (TLS code: SQUID_X509_V_ERR_DOMAIN_MISMATCH)<br>
> Certificate does not match domainname<br>
><br>
> I'm using a SAN Certificate...<br>
><br>
> I can workaround this using the directive "sslproxy_cert_error allow all". But that is not what i want...<br>
><br>
> Are there any issues known?<br>
> Is something wrong with my config?<br>
<br>
Nothing obvious.<br>
<br>
It might be related to one of the issues fixed since 4.0.3 was packaged.<br>
Are you able to try the latest 4.x snapshot ?<br>
<br>
Amos<br>
_______________________________________________<br>
squid-users mailing list<br>
squid-users@lists.squid-cache.org<br>
http://lists.squid-cache.org/listinfo/squid-users<br>
</div>
</body>
</html>